Client due diligence for accountancy practices

When due diligence is required

• When the practice establishes a business relationship (regulation 27).
• When it carries out an occasional transaction of £12,000 or more, a threshold substituted by SI 2026/621 from 30 June 2026.
• When it suspects money laundering or terrorist financing.
• When it doubts whether documents or information obtained earlier are true or adequate.
• For existing clients, at other appropriate times on a risk-sensitive basis, for example when the client's circumstances change (regulation 27).

What due diligence involves

Regulation 28 requires the practice to identify the client and verify its identity, identify the beneficial owner and take reasonable measures to verify that person's identity, understand the ownership and control structure, and assess the purpose and intended nature of the relationship.

For a company, the practice obtains and verifies the name, company number, registered office and principal place of business, and takes reasonable measures to find out the law it is subject to and the names of its directors and senior management. Regulation 28 says the practice cannot meet the beneficial ownership requirement by relying only on information delivered to the registrar.

HMRC's guidance at AMLG11300 says identity must be verified before the business relationship is established. If due diligence cannot be completed, the practice must not take the client on, must end an existing relationship, and must consider making a suspicious activity report.

Taking on a new limited company client

1. Identify the company

   Record the company name, number, registered office and principal place of business, and verify them (regulation 28).

2. Identify the people

   For example, a company with two shareholders of 50% each and one director: record each person, verify their identity and record why they count as beneficial owners.

3. Check the register and compare

   Compare the people with significant control on the Companies House register with what the client tells you. The register alone does not satisfy the beneficial ownership requirement (regulation 28).

4. Record the purpose

   Note the services, the expected activity of the business and anything that would look unusual later.

5. Assess the risk

   Decide whether simplified, standard or enhanced measures apply and record why.

6. Keep the records

   Keep the documents for five years after the relationship ends (regulation 40).

Simplified and enhanced due diligence

Regulation 37 allows simplified due diligence where the practice decides the relationship presents a low degree of risk, taking account of its risk assessment. The practice still applies due diligence and may adjust the extent, timing or type of measures, and it still monitors the relationship. Simplified measures stop if the practice doubts the documents, suspects money laundering, or no longer considers the risk low.

Regulation 33 requires enhanced due diligence where the practice or its information identifies a high risk, where the client is established in a country on the FATF call for action list, where the client is a politically exposed person or a family member or known close associate of one, where false or stolen documents have been provided, or where a transaction is unusually complex or unusually large. Enhanced measures include more information on the client and beneficial owner, the source of funds and wealth, senior management approval and closer monitoring.

Politically exposed persons

Regulation 35 requires risk-management systems to identify politically exposed persons. Taking on or continuing a relationship with one needs senior management approval, adequate measures to establish the source of wealth and source of funds, and enhanced ongoing monitoring. The rules continue for at least 12 months after the person leaves office. Since a 2024 amendment, a domestic politically exposed person is treated as presenting a lower level of risk than a non-domestic one, unless other risk factors are present.

Questions